CVE-2018-6854

CVE-2018-6854 is a Local Privilege Escalation vulnerability affecting Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2. The vulnerability stems from multiple IOCTLs that, due to improper validation of user-controlled input buffers and pointers, allow an attacker to write an error code to a kernel address. This can be leveraged to modify the SEP_TOKEN_PRIVILEGES structure, granting SE_DEBUG_NAME privilege to an exploit process. The CVSSv3 score of 7.8 (HIGH) indicates a significant risk. An attacker with local access (AV:L, PR:L) can exploit this with low complexity (AC:L), leading to high impact on confidentiality, integrity, and availability (C:H, I:H, A:H). The lack of pointer validation in METHOD_NEITHER IOCTLs is the core weakness (CWE-119). Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting a low level of public awareness or attention.